Analysis

  • max time kernel
    236s
  • max time network
    347s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 19:15

General

  • Target

    d7fb6d405ddfacfc1684ba6a3ccbc2070e17a7973e3782a11abecbc02f259f6b.exe

  • Size

    1.4MB

  • MD5

    b3fdf470658586ffe5b015f88ed4dc75

  • SHA1

    c69862eb7645c8680c0c6763ceef243df5bc95e6

  • SHA256

    d7fb6d405ddfacfc1684ba6a3ccbc2070e17a7973e3782a11abecbc02f259f6b

  • SHA512

    46e8cb6b125bdeac5ee6c950fee68090a34eea0f56f9e61c0d3120c957d90d826f2a3df7946f13824b29f4c352d88a00c94e45fc9452d7b1a9b725e527d8a4fa

  • SSDEEP

    24576:Jk70Trc/gkCNYNBsIfkUpEONJ5XBKcHE6grYO5/ovgTfAMBmNEReYW9DD8OxGFK7:JkQTAeSYMxNH5s5AsPfIBDD8OwFPQ

Score
8/10

Malware Config

Signatures

  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7fb6d405ddfacfc1684ba6a3ccbc2070e17a7973e3782a11abecbc02f259f6b.exe
    "C:\Users\Admin\AppData\Local\Temp\d7fb6d405ddfacfc1684ba6a3ccbc2070e17a7973e3782a11abecbc02f259f6b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://зябука.рф/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1940
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:5518337 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1892

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    72d82281c370f3c66cf0d9e6fe2b1e60

    SHA1

    4140ca3eb56e7cddcd804d5fd2221c722afdee19

    SHA256

    24f66b8a19fb1a60168145a6d8a31cd462f3368263d1011752d3617b17080ec8

    SHA512

    c985e1b40e567f7f22c1635bf257d39c072dc6c8325bd428d0922ec0c7052eb2bf24f8de0fac12d0efc354a8d2c8817e405c10c20eed6b66df0d40b03ce12a73

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5ZIPFCFM.txt
    Filesize

    601B

    MD5

    8b1b30f41959c54787a35629bfc1e467

    SHA1

    d1af2a707a3533299079f5bc16bf0f8f669e51e9

    SHA256

    d37946b1ac9dfa6567549ffd6ce07aeccde0adaf7731011577fc1af37f7b817e

    SHA512

    19d5870bc904392cc1af278b32d5b1759e025cc808a2d5e8784e9d07e7ba9a74efe33beec83d4891cdb67a549cd008d002ef0cd4c96767e897c71316e163a430

  • memory/1868-60-0x00000000053FA000-0x000000000540B000-memory.dmp
    Filesize

    68KB

  • memory/1868-57-0x0000000005430000-0x00000000054C8000-memory.dmp
    Filesize

    608KB

  • memory/1868-58-0x0000000075E01000-0x0000000075E03000-memory.dmp
    Filesize

    8KB

  • memory/1868-59-0x0000000005A10000-0x0000000005A48000-memory.dmp
    Filesize

    224KB

  • memory/1868-54-0x0000000000400000-0x0000000000573000-memory.dmp
    Filesize

    1.4MB

  • memory/1868-61-0x0000000000400000-0x0000000000573000-memory.dmp
    Filesize

    1.4MB

  • memory/1868-62-0x00000000053FA000-0x000000000540B000-memory.dmp
    Filesize

    68KB

  • memory/1868-63-0x0000000000400000-0x0000000000573000-memory.dmp
    Filesize

    1.4MB

  • memory/1868-64-0x00000000053FA000-0x000000000540B000-memory.dmp
    Filesize

    68KB

  • memory/1868-56-0x00000000054D0000-0x0000000005568000-memory.dmp
    Filesize

    608KB

  • memory/1868-55-0x0000000000400000-0x0000000000573000-memory.dmp
    Filesize

    1.4MB